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Abstract 

In a recent comment PQ it has been claimed that an entangled-based quantum 
key distribution protocol proposed in |3| and its generalization to d-level systems 
in [3] are insecure against an attack devised by the authors of the comment. We 
invalidate the arguments of the comment and show that the protocols are still 
secure. 
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In a recent comment [I], it has been argued that the protocols of quantum key 
distribution proposed in [2] and its generalization to d- level systems jH], are insecure 
against a special type of attack. Since the comment has been addressed only to the 
d-level scheme proposed in [3], we use in this reply the language of d— level systems, 
although we think that the authors could have primarily addressed their comment 
to the original two- level scheme proposed in [2] (and cited in [3]), in which case the 
whole discussion including their own, would have been much simpler. 

The basic idea of |3j is that Alice(a) and Bob(b) can share a maximally entangled 
state like a generalized Bell state 

|^) = ^Eli,i)a,6, (1) 

as a carrier between themselves. At the origin, Alice(a) can entangle the qudit 
q of the key (k) to this carrier by a local operation ( a generalization of Controlled 
NOT to d-dimension, namely a Controlled mod-d addition), \j,q) a ,k — ► |j> j + Q)a,k, 
producing the state 

d-l 

l^> = -7=^2 \jJ J + q)a,b,k ■ (2) 

During the transmission the value of the q will be protected from Eve, (since the 
density matrix of this key qudit will be maximally mixed) and only Bob, at the des- 
tination, can extract the value of q by disentangling it from the carrier by the reverse 
local operation \j,j + q) bjk — ► \j,q)b,k- 

In the original articles [2J El ; the possibility of entanglement of Eve with the states 
already possessed by Alice and Bob has been taken into account and methods for 
preventing her from acquiring useful information have been devised. However the au- 
thors of the comment show that Eve can perform suitable operations to intercept 
only the odd- numbered bits without being recognized by Alice and Bob. We note 
in passing that a similar comment has been made by these authors [4 on another 
protocol [2] which has been replied in 6 . 

To the original objection of the author of this reply, pointed to in that inter- 
cepting a fixed known subset does not imply insecurity, the authors of the comment 
only add a vague and inexact argument at the end of their comment and claim that 
Eve can stop and re-start her attack at any time she wants and therefore she can 
intercept any random subset of the key bits unknown to the legitimate parties. 

We show in this reply that the above claim in un-justified. The reason is quite 
simple. Stopping and re-starting the attack by Eve, requires disentangling and re- 
entangling herself with the carrier without destroying the carrier in possession of 
Alice and Bob. In fact, as shown in the original papers and reproduced in equations 



1 



(3-7) of the comment, this entangling process is a fairly delicate process, since Eve 
should entangle herself with the carrier of Alice and Bob, only by performing local 
operations on her own qudit(e) and the key qudit(k) which is in transmission. This 
important point has been simply overlooked by the authors of the comment and as 
we will show here explicitly when Eve entangles herself with the carrier in the first 
round, she can disentangle and re-entangle herself with the carrier only in the odd 
rounds of transmission. 

The authors of the comment do not present any explicit calculation as to how 
Eve can disentangle herself from the carrier and suffice to say that she can do this 
by " parity switching operations" whose meaning is unclear. To help the authors we 
explicitly show how she can do this only in the odd rounds and strongly insist that 
the authors show the way for the even rounds. 

Consider again equations (3-7) of the comment pQ, which show the state of Al- 
ice(a), Bob(b), the key qudit in transmission (k) and Eve(e) at various stages of the 
first round. Equation (4) is the initial state when Eve wants to start her attack, (i.e. 
entangle herself with the carrier). She does this by a controlled operation on the 
qudits k and e, in the form 

|j + <7i,0) fc , e — > \j + qi,j + qi)k,e 

(equation 4 and 5). After Bob extracts the key, Alice and Bob are left with the carrier 

(7) which is now entangled with Eve. Eve can disentangle herself at stage 5, by the 
reverse operation 

\j + + qi)k,e — ► b' + gi,o) fe)e . 

She can do this in any other odd round. However the authors of the comment, for 
the purpose of their attack, change this carrier by the operation shown in equation 

(8) of pQ. The carrier at the beginning of round 2 is given in equation (9) of pp. For 
the second round, the corresponding states are those of equations (9-14) of [1]. The 
authors of the comment do not show how at any stage of this round or any other even 
round, Eve can disentangle herself from the carrier. Unless they show this explicitly, 
their argument about the possibility of stopping and restarting the attack and hence 
intercepting arbitrary subsequences of the key qudits is incomplete and their conclu- 
sion about the insecurity of our protocol is invalid. 

In conclusion we have shown that Eve can stop and re-start her attack only at 
odd rounds of transmission and in this way can only intercept the odd-numbered key 
qudits, which by no means implies the insecurity of such a protocol (Hj. 
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